permissions problem in win2k

[Jeff123df2 0]

I have a problem where a User keeps appearing under my Security tab of the properties of a directory on my server.

Even though this is the only problem that i have with my server right now, I'm worried that a hacker somehow did this.

 

The icon of this user has a question mark under the face and the name shows:

S-1-5-21-776561741-1677128483-1343024091-1122

 

I never added this user and this is the second time it has shown up now and i removed it once before in the past.

The user had rights except full control.

 

I checked active directory and there is no user or group in there by that name.

 

Is there a way that i can prevent this from happening again?

Does anyone happen to know how it could have gained rights to this directory in the first place?

[clutch 1]

Generally, this can happen if an account was deleted in one security context (domain, local, or trusted) and this action wasn't replicated throughout the domain. I have seen this in the past with accounts I have deleted, yet permissions on a given object (like a folder) still have his SID (which is the number you posted) attached to the object. In NT, you would "normally" see "Account Deleted", but for some reason in Win2K you will occasionally see the actual ID.

[Uykucu 0]

Well it happens but definetly not occasionally.

The exact circumstances are if you choose security settings to be inherited from the parent (directory domain etc.) When you delete the account in question. parents do sometimes get rid of them but never the children. Dunno why it happens i am guessing to prevent fake ID's to be created and such.

 

So don't worry all admins have this your NT hasn't been breached (Yet!!!).

[clutch 1]

If it indeed happens more than "occasionally" on a given network, then there is a real problem. I would imagine that Uykucu may see it more often over several networks, and therefore may view it as something of a regular occurance.

[Jeff123df2 0]

i did create and accound and delete it later on. If i remember correctly i don't think that this problem happend until sometime after i deleted this accound.

Thanks for your help i feel much better now

[Uykucu 0]

Actually come to think of it clutch is right.

I sometimes have trouble remembering computer names or users. It gets funnier when i configure say an e-mail in a terminal that belongs to another company. It hasn't happened yet but i am sure it will soon if i can not get some decent engineers soon. Theye are all bunch of monkeys here.

[Jeff123df2 0]

last night i had to re-install win2k over itself. I went to a couple of directories that had permissions set up from my previous installation, and saw the S-1-0005blahblahblah user under the security tab for each of these directories. I saw 4 of them and had 4 users set with permissions on those directories before the re-install.

it makes a lot of sense now, thanks for your help

[Uykucu 0]

One is glad to be of service.

(considering it was directed to me. If it was clutch then just ignore this msg.

[Jeff123df2 0]

anyone who replied at least tried to help and deserves a thank you

so yes its for you and for clutch